Vulnerability · Published Jan 2, 2025 · Assigned by CERT-PL

CVE-2024-11717

Medium 6.3

In plain English

A medium-severity security flaw in CTFd from CTFd. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).

Severity (CVSS 4.0)6.3Medium

Exploit odds (30 days)0.7%top 47.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Tokens in CTFd used for account activation and password resetting can be used interchangeably for these operations. When used, they are sent to the server as a GET parameter and they are not single use, which means, that during token expiration time an on-path attacker might reuse such a token to change user's password and take over the account. Moreover, the tokens also include base64 encoded user email. This issue impacts releases up to 3.7.4 and was addressed by pull request 2679 https://github.com/CTFd/CTFd/pull/2679 included in 3.7.5 release.

Affected products (as reported)

Vendor	Product	Versions
CTFd	CTFd	0 – through 3.7.4

Weakness: CWE-837, CWE-1391 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://cert.pl/en/posts/2025/01/CVE-2024-11716 third-party-advisory
https://ctfd.io/ product
https://github.com/CTFd/CTFd/pull/2679 patch
https://blog.ctfd.io/ctfd-3-7-5/ vendor-advisory
https://seclists.org/fulldisclosure/2024/Dec/21 mailing-list, exploit
http://seclists.org/fulldisclosure/2024/Dec/21